The battle against credit fraud gets some high-tech help, by Denise Deveau
In June 2005, a credit card transaction performed at CreArtive, a small custom framing shop in downtown Toronto, was greeted with considerable fanfare. The transaction was such a huge event that senior executives from Visa and Moneris solutions, photographers and members of the press gathered to watch the country's first EMV™ chip transaction under Visa Canada's chip migration program. EMV is a global payment standard adopted by Europay, Visa and MasterCard as far back as 1996.
It's a milestone that wouldn't mean much to people outside of payment-processing circles. But for those in the industry, it's a major step forward in Canada's migration to the microchip-enabled card. Because in less than five years, just about every consumer's debit and credit cards "will be chip" - as the saying goes.
The chip card doesn't look much different than your usual magstripe card, except it has an embedded chip that is actually a mini microprocessor complete with memory, storage space, an operating system, file structure and application programs. The chip turns the card into an intelligent device that carries dynamic data that changes with each transaction, making it extremely difficult, if not impossible, for fraudsters to copy. By comparison, debit and credit cards equipped only with magstripes contain basic account and user data (such as the cardholder's name and account number) in a static format that is the same for every transaction.
"Chip [cards] can do cryptographic processing and other kinds of functionality," explains Kirkland Morris, assistant vice-president, strategic policy and programs for the Interac Association in Toronto. "The card itself plays an active role in securing transactions and the data is extraordinarily difficult to copy or change. It changes the basic parameters around security."
Among other security features, chip technology relies on two-factor authentication to complete a transaction that includes something you have (the card) and something you know (a pin number). Given Canadian consumers' years of experience with debit cards and pin numbers, migrating to a chip card should be an easy transition, Mr. Morris says.
The migration to chip technology in Canada is no small feat. It has been in the works since 2000 and has taken the collaborative efforts of leading card brands, card issuers and acquirers. Even now, only a handful of chip-enabled cards are in circulation, issued by the Royal Bank of Canada.
Moneris Solutions reports that it is currently processing 300,000 chip transactions per month - either through RBC Avion cards or European cards. That figure sounds impressive, but to put it in context, that represents less than 0.01 per cent of all transactions processed.
Although the program is still in its formative stages in Canada, chip cards have been in use for some time in Europe and Asia where fraud activity is widespread. France began using EMV chip cards a decade ago in its efforts to battle escalating fraud numbers. The move led to an 80-per-cent reduction in credit-card fraud, according to a white paper from Atos Origin.
France's gain was someone else's loss however, as other parts of Europe experienced fraud growth as a result. That's what happened to the United Kingdom, and the UK is now in the thick of its own chip migration and anticipates a 50-per-cent fraud reduction by next year.
MasterCard Canada president Kevin Stanton likens the fraud challenge to a partially-filled balloon: "Squeeze one end and the air will expand the balloon somewhere else."
"What we typically see happen is, as a country migrates to chip, fraudsters move from a more secure issuer to a less secure one," explains Allen Wright, director of chip initiatives with Visa Canada. "As a country achieves critical mass, the fraud moves to neighbouring countries or regions that are less secure."
By way of example, Mr. Wright notes that when Malaysia implemented chip, fraud went down from $670,000 (U.S.) a month in July 2003 to $50,000 a month by July 2005. However, Thailand's fraud numbers jumped from $250,000 a month to $3.4-million a month in the same time frame.
So does this mean we need to panic as the UK pushes fraud out of its system? Not at all, says Mr. Stanton. "Our current payment systems are very reliable. But the best time to fix your roof is before the rain comes."
The time is definitely right to make the switch as rain could be coming soon: North America has the potential to become the next major stop for disgruntled fraudsters, according to Mr. Stanton and others. "Right now is a great time to make the move in Canada," he explains. "Global standards and interoperability are in place. The technology is proven. We can learn from the experiences of others. We have agreement between the major players. And we have the time to make the migration without creating disruptions to the system."
As the initiative moves forward, it is expected that card issuers supporting the cause will begin phasing in new cards to consumers as a part of the natural replacement cycle. In the meantime, chip-compliant card readers are being rolled out to retail stores and plans are in the works for converting ABMs.
Visa expects that 26 per cent of cards issued will be chip-enabled by 2008. That number will reach 96 per cent by 2010. It also estimates that 39 per cent of readers will be chip-capable by 2008 with 93 per cent by the end of 2011.
On the debit side of the picture, Interac expects full conversion for ABMs to be completed by the end of December 2012. And by 2015, says Mr. Morris, "We will not process magstripe transactions from domestic cards."
While it may seem a long and arduous process, rushing the migration would not serve anyone's best interests, says Mr. Stanton. "There are so many moving parts to all this. You can't reissue cards all at once or convert point-of-sale systems overnight. You have to allow for sufficient time so you can reach critical mass without major disruptions. We want to do it once, and do it right."
New chip off the